A packet-switched network is a digital tele-communications scheme that provides interconnection of a variety of data communications devices. Geographically, these devices can be widely separated or quite close. For instance, a wide area packet-switched network (WAN) may span the world; a regional area network (RAN) may cover an entire state; and a metropolitan area network (MAN) may cover a large city. Finally, a local area network (LAN) may cover a more limited area such as a college campus or an office building. Various devices such as computers, terminals, printers, and so on, can be "plugged into" a network at specific network locations known as nodes. Each node on the network is assigned a unique address so that messages between devices at different nodes can be properly transmitted and received over the network.
Messages between devices on a packet-switched network consist of discrete packets of digital information. In order for the network to operate efficiently, such packets must conform to strict network protocol regarding transmission and format of the information packet. For instance, a well-known and commercially accepted LAN standard is encompassed by the Institute of Electrical and Electronic Engineers (IEEE) standard 802.3. The IEEE 802.3 standard features a Carrier Sense Multiple Access with Collision Detection (CSMA/CD) media access system whereby two or more nodes, that is communication devices, share a common bus transmission medium, such as a coaxial cable. To transmit over the LAN, a device at a node waits for a quiet period on the bus, that is, no other node is transmitting. The transmitting device then sends its message packet in bit-serial form at rates up to 10 Mbits/sec. The 802.3 LAN message packet is known as a "frame" and its format is highly standardized.
Obviously, management of a packet-switched network is a complicated task. For instance, modern 802.3 LAN systems can commonly accommodate numerous nodes and tolerate data traffic capacities as high as 15K frames/seconds. Hence, monitoring and management of 802.3 LAN data traffic is crucial. WAN, RAN and MAN systems may pose even larger challenges, but the general management problem is well illustrated by focusing on 802.3 LANs. Efficient management of the 802.3 LAN requires a high-level view of the network as a whole, analogous to using aerial views of metropolitan auto traffic to spot areas of congestion. A high-level view of the network would allow immediate determination of which nodes generate or receive the most traffic, which nodes are busiest at any given time, what device is at any given node, unusual or unexpected network activity, and so on. Such an "aerial" view is useful for quick detection and diagnosis of network activity.
Currently, some LAN devices provide node statistics which give tabular results summarizing activity at the nodes where the devices are located. Such devices may identify overloaded nodes but they cannot give inter-node information. Moreover, the data provided by such devices may be unintelligible to individuals without familiarity or, perhaps, expertise with the device. Inter-node information can be provided by protocol analyzers which sample LAN traffic overall to provide tabular statistics regarding the volume of node transmissions and receptions. However, such analyzers may fail to provide node-connection information and their results may be incomplete because important data may be missed in the sampling process. These devices may also require special expertise. Finally, node-connection information has been provided by a path detection software package implemented by Xerox corporation for experimental network monitoring, as described in "Measured Performance of an Ethernet Local Network", Communications Of The ACM, Dec. 1980, Vol 23, #12. This package shows whether or not a communication occurred between nodes during the measurement interval. However, it fails to indicate the volume of traffic for a given node connection. Also, it too is based on a sampling technique so that some data may be missed in the sampling process.